fix(notebook): clarify viewImage execution paths

[ewen-poch]

Problem

host.viewImage({ path }) resolves a generated file relative to the shared execution workspace used by Python, R, and REPL. The control capability called that root workspaceCwd, even though the Agent-facing Notebook MCP already uses workspaceCwd for the durable Session cwd.

That naming collision led the previous revision of this PR to bind the capability to notebookSessionRoot. The change made data/... happen to resolve, but also widened path authority to application-owned siblings such as handoff, run.json, caches, and Frame storage.

Proposed change

• keep the control capability scoped to the shared execution dataRoot
• rename the internal control binding from workspaceCwd to executionCwd
• keep the public host.viewImage JavaScript contract camelCase and unchanged
• describe { path } generically as relative to the current execution workspace, using the same relative path used to save a generated file
• verify code-relative paths succeed while application-owned sibling paths remain rejected

Scope and non-goals

• no data/... or handoff/... magic-prefix resolution
• no ambient access to notebookSessionRoot
• no change to explicit OPEN_SCIENCE_HANDOFF_DIR cross-kernel transfer
• no change to Artifact or Upload { versionId } resolution
• no new status or enum values
• no database, schema, run.json, or other persisted-data changes
• no historical-data migration or compatibility path required

Acceptance criteria and validation

Checks run after the final rebase onto origin/main (16ea4829, v0.15.1):

• execution path authority and focused consumers -> npm test -- src/main/notebook/host-view-image-service.test.ts src/main/notebook/runtime-service.test.ts src/main/notebook/local-rpc-server.test.ts src/main/notebook/local-rpc-server.capabilities.test.ts src/main/notebook/session-aggregate.test.ts src/main/notebook/e2e.certification.test.ts src/main/host-sdk/help.test.ts src/main/skills/self-awareness-skill.test.ts src/main/runtime-electron-wiring.test.ts -> 8 files passed, 308 tests passed; one environment-gated file skipped (9 tests)
• Node process type safety -> npm run typecheck:node -> passed
• lint -> npm run lint -> 0 errors; 17 pre-existing Prettier warnings
• patch hygiene -> git diff --check origin/main...HEAD -> passed
• independent Standards review -> no findings
• independent Spec review -> no findings

The impact classifier selects the full suite because resources/skills/self-awareness/SKILL.md has no declared module owner. Per maintainer request, the complete local npm test suite was not run; exact-head PR CI is authoritative for the complete and platform lanes.

Review focus

Please verify that the control capability receives executionCwd = dataRoot for both root and delegated lanes, while the Agent-facing Notebook MCP retains its separate durable Session workspaceCwd meaning.

[github-actions]

Codex Review

Verdict: mergeable

No actionable findings.

Summary: No concrete merge-blocking defects found in the pull request changes. Branch and pull request title checks are valid.

[github-actions]

Codex Review

Verdict: mergeable

No actionable findings.

Summary: The change is consistent with the notebook session-root and host-image path contract. No concrete merge-blocking defect was found. Static inspection only; no tests or project commands were run.

[github-actions]

Codex Review

Verdict: mergeable

No actionable findings.

Summary: Static inspection found no concrete merge-blocking defect in the pull request changes.

[github-actions]

Codex Review

Verdict: mergeable

No actionable findings.

Summary: Static inspection found no concrete merge-blocking defect introduced by this pull request.

[github-actions]

Codex Review

Verdict: mergeable

No actionable findings.

Summary: Static inspection found no concrete merge-blocking defect introduced by this pull request. Branch and title checks are valid.